Joint Advisory on Integrity Technology Group Fits a Broader Pattern of Chinese State-Linked Data Theft

CISA, the FBI, the NSA and cybersecurity agencies from the UK, Australia, Canada, Japan, New Zealand and Spain published a joint advisory on Oct. 8, 2026, describing cyber operations enabled by Integrity Technology Group, a for-profit company headquartered in China that CISA says has links to the Chinese government.

The advisory draws on evidence recovered during multiple FBI investigations into the company and states that threat actors enabled by Integrity Technology Group use tactics consistent with activity publicly tracked under the names Flax Typhoon, Ethereal Panda and Red Juliett, according to CISA.

Security vendors and governments routinely assign their own code names to the same cluster of activity, which complicates cross-referencing threat intelligence across reports. CISA describes Integrity Technology Group as a business that develops and resells hacking tools, operates hosting infrastructure, and breaks into networks around the world on behalf of other actors, functioning as a contractor rather than a government office. Prior to CISA and FBI advisories, similar claims have appeared about Chinese state-linked contractors acting as intermediaries that provide a degree of deniability for government-directed hacking, according to agency background material.

What the targeting looks like

CISA lists four US critical infrastructure categories hit by this activity: government services and facilities, critical manufacturing, the healthcare and public health sector, and information technology. The agency also names law enforcement agencies, schools and religious organizations among the victims, along with targets in Southeast Asia, Africa and North America outside the United States.

That spread of sectors is broad enough that most mid-size and large organizations in the United States fall somewhere within scope, a pattern consistent with earlier Flax Typhoon reporting that emphasized access for later use over narrowly targeted espionage.

A mix of off-the-shelf scanners and custom malware

CISA describes the actors’ initial reconnaissance as relying almost entirely on free, publicly available scanning software: the agency names nine such tools, among them Fscan, masscan and NMAP for network mapping, OneForAll and ksubdomain for subdomain discovery, and wpscan for WordPress-specific probing. These utilities hunt for exposed services on ports 21, 22, 53, 80, 443 and 1080, the ports commonly associated with FTP, SSH, DNS, web traffic and SOCKS proxies.

Since at least 2017, the group has also used a Python-based tool CISA calls MicroScan, which bundles more than 1,300 penetration-testing scripts. Those scripts target a mix of aging and current enterprise software, among them OpenSSL, Oracle WebLogic, the Rejetto file-sharing server, WordPress, Juniper’s ScreenOS firewall platform, the Jenkins automation server and Apache Struts. Since at least mid-January 2021, the actors have layered in command-line exploit tooling written in Python and Go, plus cross-site scripting attacks delivered through JavaScript and HTML, to gain initial access and harvest credentials, according to the advisory.

The FBI recovered an XSS payload that delivers a malicious executable named live700_v1.exe, which spawns a process disguised as DiagTrack.exe. That process communicates over HTTP with a domain the FBI attributes to Integrity Tech and appears designed to query victim mailboxes for exfiltration, CISA said.

For credential access against cloud email, the actors use an open-source Python tool called EBurst to password-spray and password-guess Microsoft Office 365 and Exchange accounts, hitting interfaces including ECP, EWS, OAB, OWA, RPC, API, MAPI, PowerShell, Autodiscover and Microsoft-Server-ActiveSync, according to CISA. For persistence, they install SoftEther VPN client software on compromised devices, frequently renamed to conhost.exe or dllhost.exe so it blends in with legitimate Windows processes and obscures command-and-control traffic.

Stolen data gets staged under deliberately bland file names such as 001.gif, Css.js, Include.png and M2k.js. A PHP script called Curlc4.txt interfaces with the Microsoft Exchange Web Services API to pull emails, contacts and calendars, sending them to a domain identified as natcloudservice[.]com, the advisory states.

How this fits with Salt Typhoon's telecom campaign

The Integrity Technology Group advisory is not the first joint warning on Chinese state-linked network intrusions this year. In August 2025, CISA, the NSA, the FBI and allied Five Eyes, EU and partner agencies detailed a long-running PRC state-sponsored espionage campaign against telecommunications, government, transportation, lodging and military networks. Industry researchers track pieces of that activity under several separate labels: Salt Typhoon is the best known, alongside names such as OPERATOR PANDA, RedMike, UNC5807 and GhostEmperor that other vendors apply to overlapping intrusion sets, according to SafeBreach’s coverage of the advisory.

That campaign, which the advisory said has been active since at least 2021, got its initial footholds through disclosed software flaws, not undisclosed zero-day bugs: CVE-2024-21887 in Ivanti Connect Secure, CVE-2024-3400 in Palo Alto GlobalProtect, CVE-2023-20198 and CVE-2023-20273 in Cisco IOS XE, and CVE-2018-0171 in Cisco Smart Install. Organizations running those products should confirm they have applied the relevant vendor patches, since all five CVEs had fixes available well before the advisory’s publication.

Once inside, the telecom-focused actors modified router access-control lists, enabled services on non-standard ports, abused Cisco Guest Shell containers, and captured authentication traffic via packet capture, exfiltrating data through GRE and IPsec tunnels and custom SFTP clients, according to the advisory. The technical overlap with the Integrity Technology Group advisory is limited, but the strategic pattern is the same: scan broadly, gain a foothold through known weaknesses, then use legitimate-looking protocols and renamed binaries to move data out undetected.

Brickstorm's long dwell time

In December 2025, CISA joined the NSA and Canada’s national cyber agency in publishing a technical breakdown of a separate backdoor known as Brickstorm. The implant runs on VMware’s vSphere virtualization platform as well as ordinary Windows machines, giving operators a foothold in both the infrastructure layer and the endpoints that run on top of it. Google Threat Intelligence Group attributes Brickstorm to a group it tracks as UNC5221, while CrowdStrike attributes the same activity to a group it calls Warp Panda, according to CyberScoop’s reporting on the joint analysis.

CrowdStrike told CyberScoop that dozens of US organizations in government, IT and legal services were affected, with the campaign dating back to at least 2022 but going undetected until mid-2025. The advisory found Brickstorm intrusions achieved persistent access averaging 393 days, among the longer dwell times publicly documented for Chinese state-linked activity.

State-sponsored actors are not just infiltrating networks, they are embedding themselves to enable long-term access, disruptions and potential sabotage

Nick Andersen, CyberScoop

That framing matches the throughline across all three advisories: the goal is not a single smash-and-grab theft but durable access that can be used, paused, or handed to a different operator months or years later.

Credential phishing aimed at AI policy circles

A China-aligned group tracked as TA419 has run credential-phishing campaigns since at least April 2025 against US and Japan-based think tanks, universities, law firms and defense contractors, according to Dark Reading’s coverage of Proofpoint research. The group has impersonated American policy figures, including someone who worked at a federal office that advises the president on science and technology matters, specifically to reach experts working on AI policy.

In a July 2026 campaign, TA419 used adversary-in-the-middle phishing built around a customized version of the open-source Frameless BitB browser-in-the-browser tool to steal both credentials and authenticated sessions. That technique bypasses the protection multifactor authentication normally provides, because the attacker captures a live session token rather than just a password, according to Proofpoint’s analysis cited by Dark Reading.

TA419’s reliance on an open-source phishing framework echoes the Integrity Technology Group advisory’s emphasis on open-source scanning and credential-spraying tools. In both cases, the underlying software is freely available and not inherently tied to any nation, which is part of why these campaigns can be harder to attribute to a specific government actor without the kind of infrastructure analysis CISA and the FBI conducted here.

AI tooling enters the picture

CrowdStrike separately reported a campaign running from late September to early October 2026 against South Korean financial organizations. The intrusion set paired a freely available, AI-driven penetration-testing framework called ARTEX with commercial large language models, according to shattered.io’s coverage of the research. CrowdStrike assessed with moderate confidence that the operator is Chinese-speaking and financially motivated, distinct from the state-linked activity described in the other advisories.

That campaign remains unattributed to any specific named group, and CrowdStrike’s own confidence level is moderate rather than high. Track this as a signal that the open-source tooling model seen in espionage campaigns is migrating into financially motivated intrusions, with AI assistance lowering the skill bar for automating reconnaissance and exploitation.

Why the overlap matters

Taken individually, each of these advisories documents a single company, backdoor or group. Taken together, they describe a recurring operational model: open-source scanners for reconnaissance, known rather than novel vulnerabilities for initial access, legitimate VPN or tunneling software for persistence, and renamed or disguised files for exfiltration. That pattern appears across the Integrity Technology Group advisory, the Salt Typhoon telecom advisory and the Brickstorm analysis, even though the named groups, victim sectors and specific tools differ.

The sector overlap is also notable. Government services, IT providers, healthcare, telecommunications and legal services all appear across more than one of these advisories, suggesting that defenders in those industries face sustained attention from distinct Chinese state-linked clusters rather than a single actor.

For network defenders, the practical takeaways cut across all five advisories cited here. Patch internet-facing edge devices promptly, since the telecom campaign relied entirely on disclosed, already-fixed flaws rather than undisclosed bugs. Check for SoftEther VPN installations and renamed system processes like conhost.exe or dllhost.exe that do not match expected behavior on a given host.

Watch Microsoft 365 and Exchange authentication logs for password-spray patterns across the full range of interfaces named in the advisory, not just the standard web login. Treat unusually long-lived administrative or service-account sessions as worth auditing, given Brickstorm’s 393-day average dwell time. Train staff who handle AI or technology policy work to recognize browser-in-the-browser phishing pages, since session-token theft defeats standard multifactor authentication.